802.1x with Vlan assignment and IP phone and PC
I have a Catalyst 4510R and I want to im plement 802.1x with dynamic VLAN assignment via Radius server. I am going to plug to switch ports Cisco IP phones and PCs (PCs are plugged in the IP phone).
For this implementation I need to configure the switch port in mode trunk because I have voice vlan corresponding IP phone and data vlan corresponding to PC.
However I have read that I can not enable 802.1x on a trunk port.
How could I configure this?
I need that when the PC is authenticated correctly is assigned to his cooresponding data vlan and the IP phone is in the voice vlan.
Thanks
You should configure the port as an access port with an aux-vlan. Here's an example:
interface GigabitEthernet2/2
switchport access vlan 701
switchport mode access
switchport voice vlan 702
load-interval 30
qos trust device cisco-phone
qos trust cos
auto qos voip cisco-phone
dot1x pae authenticator
dot1x port-control auto
tx-queue 3
bandwidth percent 33
priority high
shape percent 33
spanning-tree portfast
spanning-tree bpduguard enable
service-policy output autoqos-voip-policy
Hope this helps,
Similar Messages
-
802.1x with VLAN assignment on Catalyst 2950T-48-SI
I will really appreciate if you can confirm me if the C2950T-48-SI will support the following features.
- IEEE 802.1x with VLAN assignment
- SSHv2
- SNMPv3
The data sheet for the Cisco Catalyst 2950 Series Switches with Standard Image mentions all the above and more features for the 2950T-48-SI, but at the same time the power point presentation, (Cisco Catalyst 2950 Series Switches, and the tool Sofware advisor say that those features are only supported with the Enhanced Image.
If your those feature are supported by the Standard Image, would you please also inform the last IOS version supported.
Thanks a lot.SSH isn't available on the SI version of the 2950 as you require the Crypto features and these are not available for the SI (the documentation is a little vague here but trust me I have upgraded one and it doesn't like it...). The documentation says 'Switches that support only the SI cannot run the cryptographic image.'
802.1x with VLAN assignment is available only in the latest IOS - or at least since 12.1(22).
SNMPv3 is supported.
HTH
Andy -
871 802.1x with vlan assignment aka dynamic vlan
you can do vlan assignment on 871W wireless using the local radius server but unfort only LEAP which is N.G.
I have been pounding on wired 802.1x PEAP (which works) trying to get vlan re-assignment. Have tried with IAS which I am using to do vlan reassignment with the WLC so I have the idea of how it works with IAS. With 871, no go. Have also tried ACS for radius with same results: can't escape the switchport's vlan. With debug radius local you can see the tunnel attributes for reassignment plainly but with debug radius with IAS or ACS, nada.
Using 12.4(6)T advanced IP.
I have just seen that 12.4(4)CX2 has "802.1x with vlan reassignment" but the download is MIA. Wonder what's up with that?
Has anybody got this to work? Any info much appreciated
Greg TurnerSSH isn't available on the SI version of the 2950 as you require the Crypto features and these are not available for the SI (the documentation is a little vague here but trust me I have upgraded one and it doesn't like it...). The documentation says 'Switches that support only the SI cannot run the cryptographic image.'
802.1x with VLAN assignment is available only in the latest IOS - or at least since 12.1(22).
SNMPv3 is supported.
HTH
Andy -
WoL over 802.1X with Vlan Assignement
Hello
I have a switch 3560, and an ACS v4
In phase of test i have an infrastructure with 802.1X PEAP with automatic VLAN assignation by the ACS according to the Machine.
My question is:
it possible to implement Wake One Lan on 802.1x with a assigantion of vlan not statics (i.e. without use of command Switchport access vlan XXX)
PS: if I do in statics the VLAN on a port Wake one Lan work without Pb with 802.1XOk, on interface 0/19 :
Switchport mode access
speed 100
duplex Full
dot1x pae authenticator
dot1x port-control auto
dot1x control-direction in
spanning-tree portfast
The software use is like "wolcmd" with configuration of
MAC address of the PC
IP of the PC (give by DHCP reservation)
Subnet mask
Remote port Number : 7
The authentication on ACS work fine and on ACS whe have this field
[064] Tunnel-Type
value : VLAN
[065] Tunnel-Medium-Type
Value : 802.
[Tunnel-Private-Group-ID]
Value : 69
In fact, the only difference between config is assignation static or dynamic of VLAN
I don't know if this what you wan't
thanks -
802.1x with VLAN assignment through MS IAS radius
What is the correct input syntax of the cisco VAS at the MS IAS?
Cisco Vendor ID = 9
- [64] Tunnel-Type = VLAN
- [65] Tunnel-Medium-Type = 802
- [81] Tunnel-Private-Group-ID = VLAN NAME
ThanksNot sure of this but this link could be of some help : http://www.microsoft.com/windows2000/technologies/communications/ias/
-
I have an itunes account on my home PC. I want to use my same account but on my laptop. How do i do this with out wiping out my phone and backing up all my Pictures and Apps? Please Help.
Copy everything from the old computer or your backup copy of your old computer to your new one.
Type "move itunes library from pc to mac" or similar into the google search bar. -
When I try to use 'Stacked Column Bar'. with data assigned in the graphs, and want to see it in the 'Preview' mode in Xeclsius, I unable to see the graphs apart from the Axes ans Series Value, the graphs becomes totally invisible why So ?
Hi Ranendra,
For basic understanding of Dashboards and Models you can use standard Templates or samples which ll come along with dashboard designer(Formly Xcelsius) installation.
For path File-->Templates(or Samples).
Under Templates you ll have different categories and for each you ll find the dashboard Templates.
Regards,
Venkat P -
my iphone wont find wifi anymore, in settings the wifi button is off and it won't turn on. tried resetting and erasing phone and it still doesn't work. ???
Follow all the steps in the article below:
http://support.apple.com/kb/ts1559
If the issue remains it would be best for you to back up your phone then book an appointment at an Apple Retail Store to be evaluated.
Hope this helps -
802.1x dynamic VLAN assignment with Radius NPS Server
I can NOT get the NPS and Cisco 3550 switch to drop the authenticated user in a VLAN.
I have followed this documentation,
http://msdn.microsoft.com/en-us/library/dd314181(v=ws.10).aspx
that basically says to use these Radius attributes,
Tunnel-Medium-Type : 802
Tunnel-Pvt-Group-ID : My_VLAN_Number (also tried VLAN name)
Tunnel-Type : VLAN
There is some Cisco documentation that says to use Vendor Specific attributes Cisco-AV-Pair,
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/configuration/guide/2950scg/swauthen.html#wpxref83693
and I have also tried that,
cisco-avpair= "tunnel-type(#64)=VLAN(13)"
cisco-avpair= "tunnel-medium-type(#65)=802 media(6)"
cisco-avpair= "tunnel-private-group-ID(#81)=vlanid"
My user authenticates on the port fine, but doesn't get put into a VLAN. If I add "sw acc vlan 110" then the user authenticates and then does get an IP address in that VLAN and all is well.
Anybody know how to get dynamic VLAN assignment working with NPS?
NPS on Win 2012 R2
Domain controller separate Win 2012 R2 server
Cisco 3550 switchHi All, Can any one guide me to
configure 802.1x with acs 5.0. Its totally new look and m not able to
find document related to 802.1x.Thanks
Hi,
Check out the below link on how to configure 802.1x and ACS administration hope to help !!
http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml#MDA
Ganesh.H -
802.1x dynamic vlan assignment with acs5.0
Hi All, Can any one guide me to configure 802.1x with acs 5.0. Its totally new look and m not able to find document related to 802.1x.
ThanksHi All, Can any one guide me to
configure 802.1x with acs 5.0. Its totally new look and m not able to
find document related to 802.1x.Thanks
Hi,
Check out the below link on how to configure 802.1x and ACS administration hope to help !!
http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808abf2d.shtml#MDA
Ganesh.H -
802.1x dynamic vlan assignment using ACS 4.2
Hi
we have 10 switches 2960 configured with 802.1x authentication against ACS server 4.2.
we have 2 vlans configured on the switches for administrator and endusers. the end user vlan id is 10 and the administartor vlan is is 100.
we need to apply the following scenario, if the enduser PC - that is connected to vlan 10 - has an issue and the administrator will login to the PC with the administrator account to fix that issue, the switch should dynamically reconfigure the port with the administrator vlan ( 100 ) .
is the above scenario doable using dot1x with the ACS server?
waiting your replies
MohamedHi,
I have the following scenario
2 bulidings with multiple floor
Each floor should be in different VLAN.
The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
Each
user should be able to connect and roam around between any building.
when ever a user is connecting his laptop to any floor, he should be
made part of that respective vlan. It is not requred to have the same
IP rage to be allocated, but the dynamic VLAN should be based on the
switch port location.
Can
I configure ACS in such a way that, the ACS will allocate dynamic VLAN
for every 802.1x authentication based on the Network Device Group.
Please refer the attached diagram
Hi,
Check out the below link for your requirement for dynamic vlan assignement using ACS
http://www.ciscosystems.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml
Hope to Help !!
Ganesh.H
Remember to rate the helpful post -
802.1x Dynamic Vlan assignment using ACS
Hi,
I have the following scenario
2 bulidings with multiple floor
Each floor should be in different VLAN.
The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
Each user should be able to connect and roam around between any building. when ever a user is connecting his laptop to any floor, he should be made part of that respective vlan. It is not requred to have the same IP rage to be allocated, but the dynamic VLAN should be based on the switch port location.
Can I configure ACS in such a way that, the ACS will allocate dynamic VLAN for every 802.1x authentication based on the Network Device Group. Please refer the attached diagramHi,
I have the following scenario
2 bulidings with multiple floor
Each floor should be in different VLAN.
The network should be authenticated with 802.1x and each switch port should be assigned with dynamic VLAN from ACS.
Each
user should be able to connect and roam around between any building.
when ever a user is connecting his laptop to any floor, he should be
made part of that respective vlan. It is not requred to have the same
IP rage to be allocated, but the dynamic VLAN should be based on the
switch port location.
Can
I configure ACS in such a way that, the ACS will allocate dynamic VLAN
for every 802.1x authentication based on the Network Device Group.
Please refer the attached diagram
Hi,
Check out the below link for your requirement for dynamic vlan assignement using ACS
http://www.ciscosystems.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml
Hope to Help !!
Ganesh.H
Remember to rate the helpful post -
802.1X dyanmic VLAN assignment DHCP issue (Vista client)
I am labbing dynamic VLAN assignment and have run into a small problem. The switchport is succesfully changing to the new VLAN, but my test PC seems to get an IP address in the native data VLAN before being moved to the new dynamic assigned VLAN. So when the switch changes the VLAN the PC keeps its old IP address and nothing talks any more.
Is this a Vista issue? I thought all of these problems were just issues in XP? Do I need to tweak any interface dot1x timers?
(Cat3750 with 12.2.55 / ACS5.1. Everything else is running fine by the way.)if i do a show run on the switchport the config hasnt changed, but i dont expect it to, as its not a permanent config change that you would want to be saved by a different admin user saving the config. You can see the debug report it is changing the VLAN:
Apr 19 09:22:56.263: %AUTHMGR-5-START: Starting 'dot1x' for client (0014.c209.896f) on Interface Gi1/0/19 AuditSessionID C0A8FE250000000900291476
Apr 19 09:22:58.604: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/19, changed state to up
Apr 19 09:22:59.560: %DOT1X-5-SUCCESS: Authentication successful for client (0014.c209.896f) on Interface Gi1/0/19 AuditSessionID
Apr 19 09:22:59.568: %AUTHMGR-5-VLANASSIGN: VLAN 12 assigned to Interface Gi1/0/19 AuditSessionID C0A8FE250000000900291476
Apr 19 09:22:59.585: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan12, changed state to up
Apr 19 09:23:00.307: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/19, changed state to up
Apr 19 09:23:00.315: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (0014.c209.896f) on Interface Gi1/0/19 AuditSessionID C0A8FE250000000900291476
as well as checking with the show int switchport command and it is in v12 which is the dynamically assigned vlan
DHCP server is the cat3750 for all local VLANs -
Help needed with contact/groups synching between phone and laptop via cloud
I installed OS X 10.7.5 and my software is up to date on both my I-phone and my MacBook. I have the cloud enabled. But now, when I try to access my contact groups on my I-phone, I just get the list of groups with checks beside them; I can't select a group and have those contacts displayed as they were
prior to installing the updates. I have cloud enabled and can see the groups displated when I go to the cloud.com site. But how do I get my iphone to display contacts by groups again? If I click on "Done" with all contacts and all groups checked, the display goes out of the groups category and back to the
list of all contacts. Do I need to change something in settings? At present, when USB-connected to the Mac and in I-tunes and looking at "information"
for my Iphone, I don't have synch contacts selected. I thought synching was happening via the cloud. I didn't make any change in that I-tunes synch setting
compared with before installing the new operating system and updating the rest of my software. If I need to check "synch contacts," do I check synch all
contacts or the box for synching groups. I want to have all my contacts and all group organization that's on my computer duplicated on my phone and would like to have synching happen without having to physically connect the phone to my computer. Help would be appreciated!http://www.apple.com/business/theater/#managegroupsofcontacts
Download the "Groups" app from the app store. It is free. -
I want to simply sync my android and my mac itunes without downloading any software. Windows phone has an app to do that even though apple and windows phone are competitors. Why does android not make an app or why doesnt apple create an software or something
Apple didn't create the Windows Phone app (Microsoft). Apple has nothing to do with this, and Google should do an app for this
Maybe you are looking for
-
When I got my iphone this week, I simply used my daughter's icloud account to back up to. Fortunately, the only thing I backed up was the music, which we both like to have access to, but I had unselected the contacts and calendar for fear of having
-
How to get subquery field in the output
Hi, How to get segment_name in the output. select file_name,tablespace_name form dba_data_files where tablespace_name in(SELECT a.tablespace_name from dba_data_files a,user_segments b where a.tablespace_name=b.tablespace_name and b.segment_name='EMP'
-
Why is my imac crashing, can anyone read this apple crash report?
Wed Feb 15 16:56:24 2012 panic(cpu 1 caller 0xffffff80002c266d): Kernel trap at 0xffffff7f80e129ea, type 14=page fault, registers: CR0: 0x000000008001003b, CR2: 0x0000000000000059, CR3: 0x0000000051b5b000, CR4: 0x0000000000000660 RAX: 0x0000000000000
-
Make the currency field in SOCO editable
Hi All: PDP Scenario I have a requirement to make the currency field in SOCO. I did try to control it in SPRO > SAP SRM > Cross-App > Extensions and Field Control > Configure Control for Fields on Item Level > Metadata for Fields on Item Levels, but
-
Am i able to downgrade my IOS 7.1 to IOS 7
Am i able to downgrade my IOS 7.1 to IOS 7